From 3c7d2178681a2741a8cc8a042cb2ea6ee28528b8 Mon Sep 17 00:00:00 2001
From: tedu <>
Date: Tue, 15 Apr 2014 20:06:10 +0000
Subject: remove FIPS mode support. people who require FIPS can buy something
 that meets their needs, but dumping it in here only penalizes the rest of us.
 ok beck deraadt

---
 src/lib/libcrypto/cmac/cmac.c | 39 ++-------------------------------------
 1 file changed, 2 insertions(+), 37 deletions(-)

(limited to 'src/lib/libcrypto/cmac')

diff --git a/src/lib/libcrypto/cmac/cmac.c b/src/lib/libcrypto/cmac/cmac.c
index 8b72b09681..f92a7bb143 100644
--- a/src/lib/libcrypto/cmac/cmac.c
+++ b/src/lib/libcrypto/cmac/cmac.c
@@ -57,10 +57,6 @@
 #include "cryptlib.h"
 #include <openssl/cmac.h>
 
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
 struct CMAC_CTX_st
 	{
 	/* Cipher context to use */
@@ -107,13 +103,6 @@ CMAC_CTX *CMAC_CTX_new(void)
 
 void CMAC_CTX_cleanup(CMAC_CTX *ctx)
 	{
-#ifdef OPENSSL_FIPS
-	if (FIPS_mode() && !ctx->cctx.engine)
-		{
-		FIPS_cmac_ctx_cleanup(ctx);
-		return;
-		}
-#endif
 	EVP_CIPHER_CTX_cleanup(&ctx->cctx);
 	OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH);
 	OPENSSL_cleanse(ctx->k1, EVP_MAX_BLOCK_LENGTH);
@@ -153,24 +142,6 @@ int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen,
 			const EVP_CIPHER *cipher, ENGINE *impl)
 	{
 	static unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH];
-#ifdef OPENSSL_FIPS
-	if (FIPS_mode())
-		{
-		/* If we have an ENGINE need to allow non FIPS */
-		if ((impl || ctx->cctx.engine)
-			&& !(ctx->cctx.flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW))
-
-			{
-			EVPerr(EVP_F_CMAC_INIT, EVP_R_DISABLED_FOR_FIPS);
-			return 0;
-			}
-		/* Other algorithm blocking will be done in FIPS_cmac_init,
-		 * via FIPS_cipherinit().
-		 */
-		if (!impl && !ctx->cctx.engine)
-			return FIPS_cmac_init(ctx, key, keylen, cipher, NULL);
-		}
-#endif
 	/* All zeros means restart */
 	if (!key && !cipher && !impl && keylen == 0)
 		{
@@ -216,10 +187,7 @@ int CMAC_Update(CMAC_CTX *ctx, const void *in, size_t dlen)
 	{
 	const unsigned char *data = in;
 	size_t bl;
-#ifdef OPENSSL_FIPS
-	if (FIPS_mode() && !ctx->cctx.engine)
-		return FIPS_cmac_update(ctx, in, dlen);
-#endif
+
 	if (ctx->nlast_block == -1)
 		return 0;
 	if (dlen == 0)
@@ -261,10 +229,7 @@ int CMAC_Update(CMAC_CTX *ctx, const void *in, size_t dlen)
 int CMAC_Final(CMAC_CTX *ctx, unsigned char *out, size_t *poutlen)
 	{
 	int i, bl, lb;
-#ifdef OPENSSL_FIPS
-	if (FIPS_mode() && !ctx->cctx.engine)
-		return FIPS_cmac_final(ctx, out, poutlen);
-#endif
+
 	if (ctx->nlast_block == -1)
 		return 0;
 	bl = EVP_CIPHER_CTX_block_size(&ctx->cctx);
-- 
cgit v1.2.3-55-g6feb